Masked watermarks and related systems and techniques

ABSTRACT

Techniques are disclosed for rendering a watermark on content in a manner as to not obfuscate or otherwise cause visual defects to data elements in the content. An example methodology implementing the techniques includes segmenting a watermark to be rendered on the content into multiple watermark pieces. Then, prior to rendering a particular watermark piece, a check is made to determine whether there is a data element at the location in the content at which the particular watermark piece is to be rendered. If a data element is detected at that location, the particular watermark piece is rendered such that the data element overlays the particular watermark piece to render the watermark as a masked watermark. Otherwise, if no data element is detected at that location, the watermark piece is rendered on the content to be visible. The process is repeated to render the remaining watermark pieces.

CROSS REFERENCE TO RELATED APPLICATION

This application is a continuation of and claims the benefit of andpriority to U.S. patent application Ser. No. 16/663,971 filed on Oct.25, 2019, which application claims the benefit of PCT Patent ApplicationNo. PCT/CN2019/101539 filed on Aug. 20, 2019 in the English language inthe State Intellectual Property Office, the contents of whichapplications are hereby incorporated herein by reference in itsentirety.

BACKGROUND

Digital watermarking is a widely-used technique for marking and/orprotecting digital content including images, text, documents or otherforms of digital data which may appear on a display. Digitalwatermarking can include the use of visible watermarks. A visiblewatermark is typically provided as text, a pattern, a symbol or an imagewhich may be perceived by a human observer as being overlaid originalcontent. Visible watermarks may be provided having a see-throughcharacteristic. See-through watermarks allow both the watermark and theoriginal content to be viewed by a human observer.

SUMMARY

This Summary is provided to introduce a selection of concepts insimplified form that are further described below in the DetailedDescription. This Summary is not intended to identify key or essentialfeatures or combinations of the claimed subject matter, nor is itintended to be used to limit the scope of the claimed subject matter.

In accordance with the concepts, systems, and techniques describedherein, a system for applying a watermark over data or more generallycontent to be displayed on an electronic display or on any other meansfor visual presentation of content includes means for identifyingcontent to be displayed, means for generating a masked watermark, meansfor generating a complement watermark, and means for rendering themasked watermark and complement watermark on the content to bedisplayed.

With this particular arrangement, a system for rendering a watermark oncontent in a manner which does not obfuscate the content when thecontent is displayed is provided. In embodiments, the content may bedigitally represented (referred to herein as digital content). Byidentifying one or more data elements in the content to be displayed,regions of the content on which masked and complement watermarks may berendered without overlaying the one or more data elements in the contentto be displayed can be identified. The masked and complement watermarkscan then be rendered in the identified regions of the digital content.

The concepts and techniques for rendering a watermark over digitalcontent to be displayed may be utilized in desktop and applicationvirtualization platforms, as a means for providing data security for thecontent to be displayed.

In an embodiment, the described concepts, systems and techniques allow aportion of a complete watermark to be overlaid if a portion of a dataelement is detected to be at the same location as any portion of thewatermark when the watermark is rendered on the content. With thisapproach, an end-user is able to see the data element in the contentbeing displayed without the data elements being overlapped or otherwiseobfuscated by a watermark or portions of the watermark. This makes itunnecessary for the end-user to distinguish data element/informationfrom the watermark and the user's attention on the data will not bedisturbed. Furthermore, to avoid having information of the watermark(e.g. a purpose of the watermark or a message being conveyed by thewatermark or the meaning of the watermark) lost due to masking of aportion or portions of a watermark, a threshold may be defined to ensureat least some number of cumulative watermarks are rendered on thedigital content and shown when the digital content is displayed. Byusing some number of cumulative watermarks, information conveyed by thewatermark will not be affected or otherwise compromised. For example, ifthe purpose of the watermark is to provide a security function, thesecurity function of the watermark will not be affected or otherwisecompromised.

In one aspect, the concepts described herein are directed toward anapproach to render a watermark having parts of the watermark masked, sothat the watermark will not overlay data elements in digital content onwhich the watermark is being rendered. Rather, the watermark is renderedon portions of the digital content which either do not include any dataelements (e.g., the watermark or a portion thereof is rendered on blankareas of the content), or in regions of the content which leastinterfere (e.g. overlay or otherwise obfuscated) with underlying dataelements when the content is displayed on a display device, an interface(e.g. a user interface), a webpage, a document, an image or any othermeans capable of visual presentation of content.

In accordance with the described concepts, systems and techniques, athreshold of the number of watermark rendering is selected. Thethreshold keeps at least the defined number of cumulative watermarks tobe shown. If due to above reason of masked watermark pieces and thethreshold is not reached, this solution will detect some blank areas torender overlaid watermark pieces, so to as meet the threshold.

In general overview, described is a system and technique which splits(or more generally divides) a complete watermark into two or more pieces(i.e., the two or more pieces when taken together form a completewatermark). When rendering the watermark on content (e.g. digitalcontent), the system and technique detect whether any data elementsexist at the location in the content where the watermark pieces areabout to render. In response to determining that one or more watermarkpieces are being rendered at a location in the content at which one ormore data elements exist (i.e., one or more of the watermark pieces willoverlap or otherwise interfere with one or more data elements), the oneor more watermark pieces are masked (i.e., they are not rendered on thedigital content) such that no overlap or interference occurs between theone or more watermark pieces and the one or more data elements whendisplayed (e.g. displayed on a screen interface or document). Thisallows the watermarks (e.g., complete watermarks, masked watermarks,and/or complement watermarks) as well as the data elements in thedigital content displayed on the display to be readily viewed and easilyunderstood by a viewing user.

It should be noted that it is not necessary to recognize or otherwisedetermine the information being conveyed and/or objects being shown bythe data elements. Rather, the system and techniques need only detectthe existence of data elements which results in processing which issimpler (and thus requires fewer processing resources and less time)than processing required to recognize information being conveyed. Thus,advantageously, in one embodiment detection of data elements may bedetermined by calculating a color distribution in a region of content onwhich a watermark is to be rendered. Furthermore, even if a portion of awatermark at a location in the content at which a data element is notpresent is masked, the portion of the watermark which is not masked canbe complemented to ensure that a desired number of complete watermarksare displayed when the content is displayed.

In this way, the security functionality provided by watermarking thedigital content is still provided. Thus, advantageously, rapidprocessing techniques may be used to perform the detection of dataelements in the digital content.

When a watermark is masked, the system may determine if the remainingwatermark pieces (also referred to as complementary pieces of thewatermark(s)) convey a sufficient amount of information to serve theintended function of the complete watermark (e.g., whether the renderedwatermark pieces convey a sufficient amount of information to provide asecurity functionality). Such a determination may be made, for example,by utilizing a threshold number of complete watermarks. In embodiments,the threshold number may be defined by a system administrator. Inembodiments, the threshold number may be determined by determining anamount of space in the digital content at which no data elements exist.Other techniques may also be used. If the rendered watermark pieces cancumulate to some number of watermark instances, greater than a specifiedwatermark threshold (or in some embodiments, greater than or equal tothe watermark threshold), then the rendering of the watermark pieces isdeemed sufficient or otherwise acceptable. On the other hand, if therendered watermark pieces do not cumulate to some number of watermarkinstances, greater than the watermark threshold (or in some embodiments,greater than or equal to the watermark threshold), then placement ofwatermark pieces is deemed not sufficient and the system may implement acomplementation process. In embodiments, the complementation processrenders the masked watermark piece(s) in a blank area(s) of the digitalcontent as a complement watermark(s), such that the cumulativewatermarks (i.e., the rendered watermark pieces, including thecomplement watermark(s)), satisfy the specified threshold,

BRIEF DESCRIPTION OF THE DRAWINGS

The foregoing and other objects, features and advantages will beapparent from the following more particular description of theembodiments, as illustrated in the accompanying drawings in which likereference characters refer to the same parts throughout the differentviews. The drawings are not necessarily to scale, emphasis instead beingplaced upon illustrating the principles of the embodiments.

FIG. 1 is a block diagram illustrating an example network environment ofcomputing devices in which various aspects of the disclosure may beimplemented, in accordance with an embodiment of the present disclosure.

FIG. 2 is a block diagram illustrating selective components of anexample computing device in which various aspects of the disclosure maybe implemented, in accordance with an embodiment of the presentdisclosure.

FIG. 3 is a diagram illustrating displayed data having a watermarkdisposed thereover resulting in one or more visual defects.

FIG. 4 is a diagram illustrating displayed data having masked andcomplement watermarks disposed thereover resulting in no visual defects,in accordance with an embodiment of the present disclosure.

FIG. 4A shows an illustrative watermark segmented (or split) intomultiple pieces.

FIG. 5 is a block diagram schematically illustrating selected componentsof an example networked computer system that can be used to createmasked watermarks on content, in accordance with an embodiment of thepresent disclosure.

FIG. 5A is a schematic block diagram of a cloud computing environment inwhich various aspects of the disclosure may be implemented.

FIG. 6 is a flow diagram illustrating an example process for renderingmasked watermarks, in accordance with an embodiment of the presentdisclosure.

FIG. 7 is a flow diagram illustrating an example process for rendering awatermark by masking the watermark as necessary, in accordance with anembodiment of the present disclosure.

FIG. 8 is a flow diagram illustrating an example process forcomplementing a masked watermark, in accordance with an embodiment ofthe present disclosure.

DETAILED DESCRIPTION

Ideally, visible watermarks are relatively robust against transformationof the content (for example, against image transformation where thecontent is a photograph, or against webpage transformation where thecontent is included in a webpage). Thus, a watermark may be used toprotect or identify the content, for example, from tampering, to providecopyright protections, to provide notice or information and/or toprovide digital rights management controls over the content, forinstance. While visible watermarks can be applied to secure the content,such visible watermarks may obfuscate all or portions of the content(e.g., visible watermarks may obfuscate all or portions of objectsand/or scenes in a photograph), thus making it difficult for an observer(e.g. a human observer or an image processing system or a recognitionsystem (e.g. an optical character recognition system)) to visuallyperceive the content or to visually separate the watermark from portionsof the content (e.g., portions of a photograph) obfuscated by thewatermark.

Visible watermarks may also distract the viewer from the content (e.g.,distract the viewer from the main subject of a photograph or a webpage,for instance), thereby degrading and/or interfering with the end-userexperience. Thus, and in accordance with an embodiment of the presentdisclosure, improved watermarking techniques enable a user to apply avisual watermark to content in a manner as to not obfuscate or otherwisecause visual defects to data elements in the content when the content isdisplayed.

As used herein, the term “content” refers to the entirety of informationto be visually presented. The information may, for example, be visuallypresented using any or all of text or images, to name a few examples.The content may be visually presented on a display, an interface (e.g. auser interface), a webpage, a document, a picture or by any other meanscapable of visual presentation of content. The content may be digital oranalog (e.g. continuous parameters). The content may include one or moredata elements.

A “data element” refers to individual pieces or units of data in content(e.g. digital data in digital content). Data elements may be of interestwhen the content is viewed, such as text, images, graphical elements,control elements, objects, colors, and pixels of sufficient intensity,to name a few examples. Content, and thus data elements may exist in theform of digital data including, but not limited to, images, text,graphical elements, control elements, or other forms of digitalexpression which may appear on a display (e.g., a display screen ofcomputer or a mobile device, or any form of display or interface onwhich the content may visually presented).

As used in the remainder of this document, the term “watermark” refersto visual indicia. Any form of indicia may comprise a watermark. Theindicia may for example, be text or images or a symbol or a combinationthereof. A watermark can be visually seen when added or otherwiseapplied to content. Thus, for the purposes of the description providedherein, a distinction is made between a watermark and content.Specifically, a watermark is an element or indicia which can beperceived by a viewer, such as a human viewer, as being overlaid orotherwise applied to all or portions of content.

To apply a visual watermark to content in a manner as to not obfuscateor otherwise cause visual defects to data elements in displayed content,when rendering content that includes a watermark, the watermark appliedto the content is segmented into portions with each portioncorresponding to a piece of the complete watermark. Then, prior torendering a particular watermark piece, a check is made to determinewhether there is a data element of content at a location in the contentat which the particular watermark piece is to be rendered. If it isdetermined that a data element is present at that location, theparticular watermark piece is rendered such that the data elementoverlays the particular watermark piece so that data element, and notthe watermark piece, is visible. Otherwise, if it is determined that nodata element is present at that location, the watermark piece isrendered at that location.

Because the data element overlays the particular piece of the watermark,the data element at the same location in the content as the particularpiece of the watermark is not obfuscated when content is displayed.Also, in this case, a portion of the watermark (e.g., the portion of thewatermark overlaid by the data element) becomes “masked” by theoverlaying data element. The result is referred to herein as a “maskedwatermark.” The remaining watermark pieces are similarly processed torender the watermark on the content. Numerous configurations andmodifications will be apparent in light of this disclosure.

Turning now to the figures, FIG. 1 is a block diagram illustrating anexample network environment 101 of computing devices in which variousaspects of the disclosure may be implemented, in accordance with anembodiment of the present disclosure. As shown, environment 101 includesone or more client machines 102A-102N, one or more remote machines106A-106N, one or more networks 104, 104′, and one or more appliances108 installed within environment 101. Client machines 102A-102Ncommunicate with remote machines 106A-106N via networks 104, 104′.

In some embodiments, client machines 102A-102N communicate with remotemachines 106A-106N via an intermediary appliance 108. The illustratedappliance 108 is positioned between networks 104, 104′ and may also bereferred to as a network interface or gateway. In some embodiments,appliance 108 may operate as an application delivery controller (ADC) toprovide clients with access to business applications and other datadeployed in a datacenter, a cloud computing environment, or delivered asSoftware as a Service (SaaS) across a range of client devices, and/orprovide other functionality such as load balancing, etc. In someembodiments, multiple appliances 108 may be used, and appliance(s) 108may be deployed as part of network 104 and/or 104′.

Client machines 102A-102N may be generally referred to as clientmachines 102, local machines 102, clients 102, client nodes 102, clientcomputers 102, client devices 102, computing devices 102, endpoints 102,or endpoint nodes 102. Remote machines 106A-106N may be generallyreferred to as servers 106 or a server farm 106. In some embodiments, aclient device 102 may have the capacity to function as both a clientnode seeking access to resources provided by server 106 and as a server106 providing access to hosted resources for other client devices102A-102N. Networks 104, 104′ may be generally referred to as a network104. Networks 104 may be configured in any combination of wired andwireless networks.

Server 106 may be any server type such as, for example: a file server;an application server; a web server; a proxy server; an appliance; anetwork appliance; a gateway; an application gateway; a gateway server;a virtualization server; a deployment server; a Secure Sockets LayerVirtual Private Network (SSL VPN) server; a firewall; a web server; aserver executing an active directory; a cloud server; or a serverexecuting an application acceleration program that provides firewallfunctionality, application functionality, or load balancingfunctionality.

Server 106 may execute, operate or otherwise provide an application thatmay be any one of the following: software; a program; executableinstructions; a virtual machine; a hypervisor; a web browser; aweb-based client; a client-server application; a thin-client computingclient; an ActiveX control; a Java applet; software related to voiceover internet protocol (VoIP) communications like a soft IP telephone;an application for streaming video and/or audio; an application forfacilitating real-time-data communications; a HTTP client; a FTP client;an Oscar client; a Telnet client; or any other set of executableinstructions.

In some embodiments, server 106 may execute a remote presentationservices program or other program that uses a thin-client or aremote-display protocol to capture display output generated by anapplication executing on server 106 and transmit the application displayoutput to client device 102.

In yet other embodiments, server 106 may execute a virtual machineproviding, to a user of client device 102, access to a computingenvironment. Client device 102 may be a virtual machine. The virtualmachine may be managed by, for example, a hypervisor, a virtual machinemanager (VMM), or any other hardware virtualization technique withinserver 106.

In some embodiments, network 104 may be: a local-area network (LAN); ametropolitan area network (MAN); a wide area network (WAN); a primarypublic network; and a primary private network. Additional embodimentsmay include a network 104 of mobile telephone networks that use variousprotocols to communicate among mobile devices. For short rangecommunications within a wireless local-area network (WLAN), theprotocols may include 802.11, Bluetooth, and Near Field Communication(NFC).

FIG. 2 is a block diagram illustrating selective components of anexample computing device 100 in which various aspects of the disclosuremay be implemented, in accordance with an embodiment of the presentdisclosure. For instance, client devices 102, appliances 108, and/orservers 106 of FIG. 1 can be substantially similar to computing device100. As shown, computing device 100 includes one or more processors 103,a volatile memory 122 (e.g., random access memory (RAM)), a non-volatilememory 128, a user interface (UI) 123, one or more communicationsinterfaces 118, and a communications bus 150.

Non-volatile memory 128 may include: one or more hard disk drives (HDDs)or other magnetic or optical storage media; one or more solid statedrives (SSDs), such as a flash drive or other solid-state storage media;one or more hybrid magnetic and solid-state drives; and/or one or morevirtual storage volumes, such as a cloud storage, or a combination ofsuch physical storage volumes and virtual storage volumes or arraysthereof.

User interface 123 may include a graphical user interface (GUI) 124(e.g., a touchscreen, a display, etc.) and one or more input/output(I/O) devices 126 (e.g., a mouse, a keyboard, a microphone, one or morespeakers, one or more cameras, one or more biometric scanners, one ormore environmental sensors, and one or more accelerometers, etc.).

Non-volatile memory 128 stores an operating system 115, one or moreapplications 116, and data 117 such that, for example, computerinstructions of operating system 115 and/or applications 116 areexecuted by processor(s) 103 out of volatile memory 122. In someembodiments, volatile memory 122 may include one or more types of RAMand/or a cache memory that may offer a faster response time than a mainmemory. Data may be entered using an input device of GUI 124 or receivedfrom I/O device(s) 126. Various elements of computing device 100 maycommunicate via communications bus 150.

The illustrated computing device 100 is shown merely as an exampleclient device or server and may be implemented by any computing orprocessing environment with any type of machine or set of machines thatmay have suitable hardware and/or software capable of operating asdescribed herein.

Processor(s) 103 may be implemented by one or more programmableprocessors to execute one or more executable instructions, such as acomputer program, to perform the functions of the system. As usedherein, the term “processor” describes circuitry that performs afunction, an operation, or a sequence of operations. The function,operation, or sequence of operations may be hard coded into thecircuitry or soft coded by way of instructions held in a memory deviceand executed by the circuitry. A processor may perform the function,operation, or sequence of operations using digital values and/or usinganalog signals.

In some embodiments, the processor can be embodied in one or moreapplication specific integrated circuits (ASICs), microprocessors,digital signal processors (DSPs), graphics processing units (GPUs),microcontrollers, field programmable gate arrays (FPGAs), programmablelogic arrays (PLAs), multi-core processors, or general-purpose computerswith associated memory.

Processor 103 may be analog, digital or mixed-signal. In someembodiments, processor 103 may be one or more physical processors, orone or more virtual (e.g., remotely located or cloud computingenvironment) processors. A processor including multiple processor coresand/or multiple processors may provide functionality for parallel,simultaneous execution of instructions or for parallel, simultaneousexecution of one instruction on more than one piece of data.

Communications interfaces 118 may include one or more interfaces toenable computing device 100 to access a computer network such as a LocalArea Network (LAN), a Wide Area Network (WAN), a Personal Area Network(PAN), or the Internet through a variety of wired and/or wirelessconnections, including cellular connections.

In described embodiments, computing device 100 may execute anapplication on behalf of a user of a client device. For example,computing device 100 may execute one or more virtual machines managed bya hypervisor. Each virtual machine may provide an execution sessionwithin which applications execute on behalf of a user or a clientdevice, such as a hosted desktop session. Computing device 100 may alsoexecute a terminal services session to provide a hosted desktopenvironment. Computing device 100 may provide access to a remotecomputing environment including one or more applications, one or moredesktop applications, and one or more desktop sessions in which one ormore applications may execute.

FIG. 3 is a diagram illustrating a displayed web page with contenthaving a watermark disposed thereover resulting in one or more visualdefects. As shown in FIG. 3, three watermarks 310, 312, and 314 areapplied or otherwise added to contents of the webpage. As can be seen,each watermark 310, 312, and 314 is composed of two lines of text: thetext “Confidential information” in a first line and the text “Providedto Fuping Zhou” in a second line below the first line. As can be furtherseen in FIG. 3, watermark 310 is rendered on the content in such amanner as to cause a portion of watermark 310 (e.g., the text“information” and “ing Zhou”) to overlay a data element 311. Similarly,watermark 312 is rendered on the content in such a manner as to cause aportion of watermark 312 (e.g., the text “ion” and “hou”) to overlay adata element 313, and watermark 314 is rendered on the content in such amanner as to cause a portion of watermark 314 (e.g., the text “Co” and“Prov”) to overlay a data element 315. As can be seen in this example,portions of watermarks 310, 312, and 314 that overlay data elements inthe content interfere with and cause visual defects to the data elementswhen watermarks 310, 312, and 314 are rendered on the content. Thus, itcan be appreciated that trivially applying watermarks to content (e.g. aphotograph or a webpage, to provide two examples) often leads to thewatermarks obfuscating or otherwise interfering with data elements inthe content when the watermarks are rendered on the content.

However, as will be described below in conjunction with FIGS. 4-8, inaccordance with the concepts, systems and techniques described herein, awatermark may be rendered on content such that portions of the watermarkthat obfuscate or otherwise interfere with data elements in the contentare masked to allow the data elements (which would otherwise be belowthe watermark) to be clearly visible when the content is displayed.

FIG. 4 is a diagram illustrating a displayed web page having contentwith masked and complement watermarks disposed thereover resulting in novisual defects.

A masked watermark refers to a watermark in which a portion (or piece)thereof is not visible (e.g. has been removed) when the watermark isapplied (e.g. rendered or otherwise applied) on content.

A complement watermark is a portion of a watermark which, when viewedwith (or taken together with) a masked watermark, results in a complete(or at least a more complete) watermark. For reasons which will becomeapparent from the description hereinbelow, in embodiments, one or morecomplement watermarks may be needed to (along with a masked watermark)to result in a complete watermark. Also, in embodiments, a complementwatermark may be used with more than one masked watermark to result inmultiple complete watermarks.

Specifically, FIG. 4 illustrates portions of watermarks 310, 312, and314 of FIG. 3 masked so as to not cause visual defects to data elementsin the content. For instance, in the illustrative example of FIG. 4, thewebpage may have been created to include three instances of thewatermark on the left half of the webpage (e.g. as illustrated bywatermarks 310, 312, and 314 in FIG. 3).

As shown in FIG. 4, three masked watermarks 410, 412, and 414 arerendered on a content of the webpage. Masked watermark 410 is a portionof watermark 310 in FIG. 3, masked watermark 412 is a portion ofwatermark 312 in FIG. 3, and masked watermark 414 is a portion ofwatermark 314 in FIG. 3. In particular, masked watermark 410 does notinclude the portion of the watermark (e.g., the text “Information” and“Fuping Zhou”) that would overlay and obfuscate data element 411 in thewebpage. Similarly, masked watermark 412 does not include the portion ofthe watermark (e.g., the text “tion” and “hou”) that would overlay andobfuscate data element 413 in the webpage, and masked watermark 414 doesnot include the portion of the watermark (e.g., the text “Conf” and“Prov”) that would overlay and obfuscate data element 415 in thewebpage. That is, masked watermarks 410, 412, and 414 each include theportion of the watermark that does not overlay data elements (e.g.,texts and images) of the content.

It should, however, be noted that some or all of a masked watermark canbe rendered on a portion of the content that is not blank or otherwisean empty area in the content. For example, as can be seen in the examplein FIG. 4, masked watermark 410 and a portion of masked watermark 412are each rendered on respective portions of the content that are notblank but, rather, appear to have some type of coloring or grey shading.Also, a portion of masked watermark 414 (e.g., parts of the text “form”and “g Zho”) is rendered to overlay a portion of a data element 416.According to some embodiments, this may be due to the criteria orthreshold used to determine what constitutes a data element in thecontent (e.g., a data element in an image or a data element in awebpage), which will be further described below.

As further shown in FIG. 4, so-called “complement watermarks” 417 and418 are rendered on the webpage. Complement watermarks 417 and 418 arerendered on the content so as to not overlay and obfuscate any dataelements included in the content. For example, as can be seen in FIG. 4,complement watermarks 417 and 418 are rendered on areas of the contentwhere there are no data elements (so-called “blank areas”).

In brief, one or more complement watermarks can be applied to thecontent such that when the one or more complement watermarks areconsidered together (e.g. combined) with a masked watermark, a“complete” watermark may be viewed or otherwise perceived. According toan embodiment, a complement watermark can include a portion of awatermark that was “masked” (i.e., is not visible) when rendering thewatermark on the content (e.g., the portion of the watermark that wouldhave overlaid data elements in the content when rendered). In thissense, a complement watermark “complements” a masked watermark. That is,a masked watermark when taken together with one or more complementwatermarks forms a complete watermark.

As can be seen in FIG. 4, complement watermark 417, which includes thetext “tion” and “hou”, complements masked watermark 412 (i.e., maskedwatermark 412 and complement watermark 417 can be combined to create acomplete watermark—e.g., an instance of a complete watermark rendered onthe content). Likewise, complement watermark 418, which includes thetext “Information” and “Fuping Zhou”, complements masked watermark 410in that masked watermark 410 and complement watermark 418 can becombined to create a complete watermark (e.g., another instance of thecomplete watermark rendered on the content).

Thus, multiple complement watermarks may be combined with a maskedwatermark to create a complete watermark. That is, a portion of awatermark that was “masked”, thus resulting in a masked watermark, canbe segmented or otherwise split, and the segments may be included inmultiple respective complement watermarks. It should also be noted thata complement watermark can complement one or more (multiple) maskedwatermarks.

Continuing the illustrative example of FIG. 4, it may have been that athreshold number of instances of a complete watermark (e.g., apre-established watermark threshold), such as two (2), three (3), four(4), or other suitable number (N), is required or otherwise needed to berendered on the content. In such examples, the specified thresholdnumber of instances of the complete watermark may be rendered so as topreserve the intended security functionality associated with providingwatermarks, for instance. In the example of FIG. 4, the watermarkthreshold may have been two (2). In this example case, the two instancesof the complete watermark rendered by combining masked watermark 410 andcomplement watermark 418 and by combining masked watermark 412 andcomplement watermark 417 satisfy the specified watermark threshold. Notethat masked watermark 414 need not be completed to create an instance ofa complete watermark (e.g., need not be complemented with one or morecomplement watermarks) since the specified watermark threshold issatisfied by the combination of masked watermark 410 and complementwatermark 418 and the combination of masked watermark 412 and complementwatermark 417.

However, and as can be further seen in FIG. 4, masked watermark 414 canbe rendered on the content in its incomplete or masked state.Furthermore, as will be appreciated in light of this disclosure, any twoof the masked watermarks 410, 412, and 414, and not necessarily maskedwatermarks 410 and 412, may be complemented to create two instances ofthe complete watermark rendered on the content, thus satisfying thespecified watermark threshold. In some such example embodiments, allthree masked watermarks 410, 412, and 414 may be complemented to satisfythe specified watermark threshold. In a more general sense, any numberof the watermarks added to content can be complemented to satisfy thespecified watermark threshold.

FIG. 4A shows an illustrative watermark segmented (or split) intomultiple pieces. As shown, the illustrative watermark is composed of twolines of text: the text “WATERMARK” in a first line and the text “TEXT”in a second line below the first line. In particular, and in accordancewith certain of the embodiments disclosed herein, a watermark issegmented into multiple pieces, and the pieces of the watermark areprocessed to determine whether a portion or portions of the watermarkwould overlay data elements in the content when the watermark isrendered on the content. In some such embodiments, a bounding box isgenerated for the watermark such that the bounding box encloses thewatermark. The generated bounding box delineates or defines the bounds(e.g., boundary) of the watermark. For example, a bounding box may bespecified by the coordinates of the four corners of the bounding box. Insome embodiments, a bounding box for a watermark is generated in amanner as to tightly bound the watermark. That is, the bounding box isgenerated such that, within the bounding box, the number of pixels thatdo not represent the watermark is reduced or, ideally, minimized.Reducing the number of pixels that do not represent the watermark in thebounding box results in a reduction in computational costs. For example,reducing (or ideally minimizing) the number of pixels that do notrepresent a watermark reduces the number of “unnecessary” pixels thatneed to be processed in segmenting the watermark.

As shown in the illustrative embodiment of FIG. 4A, a bounding box 430can be generated for the watermark. In one embodiment, a pixel map thatrepresents the area inside bounding box 430, including the watermark,can be created and used to appropriately segment the watermark intopieces. For example, in one such embodiment, bounding box 430 can besegmented along its width (e.g., x-dimension) to segment the watermarkenclosed within bounding box 430. As can be seen in the example of FIG.4A, bounding box 430 is segmented into five (5) pieces so as to createfive pieces of the watermark. In other embodiments, a bounding boxenclosing a watermark can be segmented along its height (e.g.,y-dimension) to segment the watermark enclosed within the bounding box.In any case, the pixel map of a bounding box can be used to segment thebounding box.

In embodiments, the watermark can be split into equal size pieces. Forexample, suppose the watermark illustrated in FIG. 4A is 400 pixels inwidth. In this example case, the watermark 400 pixels wide may besegmented into five pieces (five watermark pieces), wherein each pieceis 80 pixels in width, as can be seen in FIG. 4A.

In embodiments, the number of pieces into which a watermark is to besegmented may be pre-established (i.e. fixed) or may be tunable (i.e.selectable). In one example implementation, the number of pieces intowhich a watermark is to be segmented may be specified using a tunableparameter. For example, this tunable parameter may be specified in aconfiguration file that is accessible to an authorized user (such as asystem administrator), and the user may tune or adjust the parameterbased on a desired level of performance. In some implementations, thistunable parameter may be automatically tuned (e.g., via a processor)based on current and/or past levels of performance. In any case, thenumber of pieces into which a watermark is to be segmented can bedetermined based on one or more factors such as the size of thewatermark (e.g., the number of pixels in the watermark or, in the caseof a text watermark, the number of letters in the watermark; the amountof space (e.g., area) available in which a watermark may be placed, thedensity of data elements in the content, and a ratio of the number ofpixels in the watermark to the number of pixels in the data elements tobe displayed, to provide a few examples.

In embodiments, the watermark can be segmented into pieces which are notequal in size. For example, if the watermark is 400 pixels in width,then the watermark may be split into six pieces of 50 pixels width eachand one piece of 100 pixels width. In one example implementation, thewatermark may be presented in a window with a horizontal scroll barand/or a vertical scroll bar. A user can then manipulate the providedscroll bars to indicate where and how the watermark is to be split orsegmented (thus, effectively selecting the number of segments).

FIG. 5 is a block diagram schematically illustrating selected componentsof an example networked computer system that can be used to createmasked watermarks on content, in accordance with an embodiment of thepresent disclosure. More specifically, the system illustrated in FIG. 5can be understood as enabling a user 502 to leverage the services of awatermark system 504. For instance, user 502 can use the services ofwatermark system 504 to render one or more masked watermarks on content.In some implementations of watermark system 504, content that includeswatermarks may have been created, and user 502 can use the services ofwatermark system 504 to render one or more of the watermarks on thecontent as masked watermarks. In such embodiments, user 502 cancommunicate with watermark system 504 via a network 506. Note that theillustrative networked computer system depicted in FIG. 5 is an exampleonly and assumes only a single user. However, it should be understoodthat the networked computer system depicted in FIG. 5 is easily extendedto an arbitrary number of users and their associated devices for use inrendering masked watermarks and/or generating content to include maskedwatermarks in accordance with the techniques described herein. Forexample, a multiple number of users can leverage the services ofwatermark system 504. It will therefore be appreciated that theembodiments disclosed herein are not intended to be limited to the useof watermark system 504 by a single user at any one time. It will alsobe appreciated that the embodiments disclosed herein are not intended tobe limited to the use of watermark system 504 to render maskedwatermarks on content. Rather, it will be apparent in light of thisdisclosure that watermark system 504 can be used to add maskedwatermarks to content, such as content in a photograph, content in awebpage, or content in a digital book, to provide three examples.

Network 506 may be a local area network (such as a home-based or officenetwork), a wide area network (such as the Internet), a peer-to-peernetwork (such as a Bluetooth connection), or a combination of suchnetworks, whether public, private, or both. In certain embodiments, atleast a portion of the functionality associated with network 506 isprovided by a cellular data network, thereby making it easier for usersof mobile computing devices to leverage the services of watermark system504. In general, communications amongst the various entities andresources described herein may occur via wired or wireless connections,such as may be provided by Wi-Fi or mobile data networks. In thisregard, network 506 is substantially similar to networks 104 and 104′described previously with respect to FIG. 1.

As illustrated in FIG. 5, user 502 has access to a device thatfacilitates interaction with components of watermark system 504illustrated in FIG. 5 or are otherwise described herein. For example, incertain embodiments, user 502 has access to one or more of a variety ofsuitable computing devices, including devices such as desktop computers,laptop computers, workstations, enterprise class server computers,handheld computers, tablet computers, cellular telephones, smartphones,and set-top boxes. Other devices may be used in other embodiments. Thedevice or devices used by user 502 optionally include a wired and/orwireless communication adapter that enables communication via network506. The device or devices also optionally include input/outputcomponents such as one or more of a tactile keyboard, a display, a touchsensitive display, a microphone, a camera, and location services. Suchinput/output components allow user 502 to not only control operation ofits own device, but also to control certain operational aspects ofwatermark system 504.

Referring still to the example embodiment illustrated in FIG. 5,watermark system 504 can be configured to facilitate the generation ofcontent that includes one or more masked watermarks. In someembodiments, watermark system 504 is also configured to facilitate themasking of pre-existing watermarks included in the content in order tocause rendering of the content with masked watermarks. To this end, inone embodiment, watermark system 504 includes one or more softwaremodules configured to implement certain of the functionalities disclosedherein, and optionally further includes hardware configured to enablesuch implementation. This hardware and/or software may include, but isnot limited to, a processor 508, a memory 510, an operating system 512,a communication module 514, and a data store 516.

Processor 508 may be designed to control the operations of the variousother components of watermark system 504. Processor 508 may include anyprocessing unit suitable for use in watermark system 504, such as asingle core or multi-core processor. In general, processor 508 mayinclude any suitable special-purpose or general-purpose computer,computing entity, or computing or processing device including variouscomputer hardware, or firmware, and may be configured to executeinstructions, such as program instructions, stored on any applicablecomputer-readable storage media. For example, processor 508 may includea microprocessor, a central processing unit (CPU), a microcontroller, adigital signal processor (DSP), an application-specific integratedcircuit (ASIC), a Field-Programmable Gate Array (FPGA), ComplexInstruction Set Computer (CISC), Reduced Instruction Set Computer(RISC), multi core, or any other digital or analog circuitry configuredto interpret and/or to execute program instructions and/or to processdata, whether loaded from memory or implemented directly in hardware.Although illustrated as a single processor in FIG. 5, processor 508 mayinclude any number of processors and/or processor cores configured to,individually or collectively, perform or direct performance of anynumber of operations described in the present disclosure. In thisregard, processor 508 is substantially similar to processor 103described previously with respect to computing device 100 of FIG. 2.

Memory 510 may include computer-readable storage media configured forcarrying or having computer-executable instructions or data structuresstored thereon. Such computer-readable storage media may include anyavailable media that may be accessed by a general-purpose orspecial-purpose computer, such as processor 508. By way of example, andnot limitation, such computer-readable storage media may includenon-transitory computer-readable storage media including Random AccessMemory (RAM), Dynamic Random Access Memory (DRAM), Synchronized DynamicRandom Access Memory (SDRAM), Static Random Access Memory (SRAM),non-volatile memory (NVM), or any other suitable storage medium whichmay be used to carry or store particular program code in the form ofcomputer-executable instructions or data structures and which may beaccessed by a general-purpose or special-purpose computer. Combinationsof the above may also be included within the scope of computer-readablestorage media. In this regard, memory 510 is substantially similar tovolatile memory 122 described previously with respect to computingdevice 100 of FIG. 2.

Operating system 512 may comprise any suitable operating system, such asUNIX®, LINUX®, MICROSOFT® WINDOWS® (Microsoft Crop., Redmond, Wash.),GOOGLE® ANDROID™ (Google Inc., Mountain View, Calif.), APPLE® iOS (AppleInc., Cupertino, Calif.), or APPLE® OS X° (Apple Inc., Cupertino,Calif.). As will be appreciated in light of this disclosure, thetechniques provided herein can be implemented without regard to theparticular operating system provided in conjunction with watermarksystem 504, and therefore may also be implemented using any suitableexisting or subsequently developed platform. In this regard, operatingsystem 512 is substantially similar to operating system 115 describedpreviously with respect to computing device 100 of FIG. 2.

Communication module 514 can be any appropriate network chip or chipsetwhich allows for wired or wireless communication via a network ornetworks, such as network 506 for instance, to one or more of the othercomponents described herein. Communication module 514 can also beconfigured to provide intra-device communications via a bus or aninterconnect. In this regard, communication module 514 is substantiallysimilar to communication interface 118 described previously with respectto computing device 100 of FIG. 2.

Data store 516 may include any type of computer-readable storage mediaconfigured for short-term or long-term storage of data. By way ofexample, and not limitation, such computer-readable storage media mayinclude a hard drive, solid-state drive, Read-Only Memory (ROM),Electrically Erasable Programmable Read-Only Memory (EEPROM), CompactDisc Read-Only Memory (CD-ROM) or other optical disk storage, magneticdisk storage or other magnetic storage devices, flash memory devices(e.g., solid state memory devices), non-volatile memory (NVM), or anyother storage medium, including those provided above in conjunction withmemory 510, which may be used to carry or store particular program codein the form of computer-readable and computer-executable instructions,software or data structures for implementing the various embodiments asdisclosed herein and which may be accessed by a general-purpose orspecial-purpose computer. Combinations of the above may also be includedwithin the scope of computer-readable storage media. Data store 516 maybe provided on watermark system 504 or provided separately or remotelyfrom watermark system 504. In this regard, data store 516 issubstantially similar to non-volatile memory 128 described previouslywith respect to computing device 100 of FIG. 2.

Referring again to the example embodiment illustrated in FIG. 5,watermark system 504 further includes a watermark application 518, whichincludes a watermark mask module 520 and a masked watermarkcomplementation module 522. Watermark application 518 is generallyconfigured to provide the overall control of the masking of watermarksand rendering of masked watermarks on content utilizing the services andfunctionality of watermark mask module 520 and masked watermarkcomplementation module 522. The watermark application may also renderthe content and watermarks on an image, display, browser, userinterface, a printed document or the like utilizing the services andfunctionality of watermark mask module 520 and masked watermarkcomplementation module 522.

In particular, and according to some embodiments, watermark application518 determines the presence of a watermark to be rendered on the contentat or when the content is being rendered for display on a displaydevice, for example. To render the watermark, watermark application 518can segment the watermark into multiple pieces and cause the renderingof the watermark piece by piece. In some such embodiments, watermarkapplication 518 can utilize watermark mask module 520 to render eachwatermark piece.

As will be further described below, according to one embodiment,watermark mask module 520 can either render a watermark piece on thecontent (e.g., so that the watermark piece overlays data in the content)or render the watermark such that a data element in the content overlaysthe watermark piece. In the case where a data element overlays thewatermark piece, the watermark piece becomes masked thus resulting inthe watermark being rendered on the content as a masked watermark.

In some embodiments, watermark application 518 is configured to checkthat the instances of the masked watermarks, including any completewatermarks (any watermarks that are not masked), rendered on content(and subsequently on an image, display, or browser, user interface, aprinted document or the like) satisfy a watermark threshold. Forexample, when a watermark is rendered as a masked watermark on thecontent, the intended function of the watermark (a complete watermark)may not be preserved. That is, the masked watermark that is rendered maynot convey a sufficient amount of information to serve the intendedfunction for the complete watermark. The watermark threshold, whichdefines a number of complete watermark instances that need to berendered on the content, may be a form of guarantee that the intendedfunctionality of watermarking content is not lost by rendering maskedwatermarks on the content. In such embodiments, watermark application518 checks to determine whether the rendered watermark pieces (thewatermark pieces rendered as part of rendered masked watermarks andrendered complete watermarks) satisfy the watermark threshold. If therendered watermark pieces can combine or otherwise cumulate to a numberof complete watermark instances to satisfy the watermark threshold, thenwatermark application 518 can conclude that the rendering of thewatermark pieces is acceptable or otherwise sufficient. Otherwise, ifthe rendered watermark pieces do not cumulate to a number of completewatermark instances to satisfy the watermark threshold, then watermarkapplication 518 can conclude that the rendering of the watermark piecesis not sufficient. In cases where the rendered watermark pieces do notcumulate to a number of complete watermark instances to satisfy thewatermark threshold, watermark application 518 can utilize maskedwatermark complementation module 522 to render the masked watermarkpieces (e.g., the portions of the watermarks masked during the renderingof the watermarks). As will be further described below, according to oneembodiment, masked watermark complementation module 522 can render themasked watermark pieces on the content as necessary to satisfy thewatermark threshold.

In embodiments, the watermark threshold may be specified using a tunableparameter. For example, this tunable parameter may be specified in aconfiguration file that is accessible to an authorized user (such as asystem administrator), and the user may tune or adjust the parameterbased on a desired level of performance. In some implementations, thistunable parameter may be automatically tuned (e.g., via a processor)based on one or more factors such as an amount of space in the contentat which no data elements exist, to provide only one example. Otherfactors may also be used such as one or more of the factors describedpreviously with respect to determining the number of pieces to segment awatermark.

Watermark mask module 520 is configured to detect the presence of dataelements at a location in the content at which a watermark piece is tobe rendered. For example, in an example implementation, watermark maskmodule 520 can detect data elements in the content based on adistribution of the colors (e.g., color histogram) in the content. Inother implementations, watermark mask modules 520 may employ othertechniques, such as pixel intensity (gray intensity or color intensity),pixel luminance, and edge detection, to provide a few examples, todetect data elements in the content, as will be apparent to one of skillin the art. If a data element is detected at a location a watermarkpiece is to be rendered, then watermark mask module 520 renders thewatermark piece on the content such that the data element overlays thewatermark piece. Otherwise, if a data element is detected at a locationa watermark piece is to be rendered, then watermark mask module 520renders the watermark piece on the content (e.g., the watermark pieceoverlays the data in the content). Watermark mask module 520 is furtherdescribed below with respect to FIG. 7.

Masked watermark complementation module 522 is configured to complementthe rendered masked watermarks by rendering the portions of the maskedwatermarks which were not rendered due to the presence of data elements.To do so, in accordance with one embodiment, masked watermarkcomplementation module 522 organizes the watermark pieces that need tobe rendered into organized lists of watermark pieces. As an example,assume a watermark is composed of watermark pieces A, B, C, D, E and F.Also assume that a first rendered instance of the watermark on thecontent is a first masked watermark having watermark pieces A, B, and C,and a second rendered instance of the watermark on the content is asecond masked watermark having watermark pieces E and F. That is, inrendering the two instances of the watermark, watermark pieces D, E, andF have been masked (overlaid with a data element) in the first maskedwatermark, and watermark pieces A, B, C, and D were masked in the secondmasked watermark. In this example, masked watermark complementationmodule 512 can organize watermark pieces D, E, and F into a first listand watermark pieces A, B, C, and D into a second list. Watermark piecesD, E, and F included in the first list effectively become one watermarkpiece, and watermark pieces A, B, C, and D included in the second listeffectively become another watermark piece. Here, the first list ofwatermark pieces D, E, and F can be rendered together to complement thefirst masked watermark (e.g., the rendered first masked watermark whencomplemented by the rendered watermark pieces D, E, and F form a firstinstance of the complete watermark), and the second list of watermarkpieces can be rendered together to complement the second maskedwatermark (e.g., the rendered second masked watermark when complementedby the rendered watermark pieces A, B, C, and D form a second instanceof the complete watermark). Then, starting with the longest list ofneeded watermark pieces, masked watermark complementation module 522determines whether there is an area in the content that does not containa data element and is large enough to render the watermark pieces in thelist. If such an area is found in the content, masked watermarkcomplementation module 522 renders the watermark pieces in the list onthe found area. The rendered watermark pieces can be referred to as acomplement watermark. Otherwise, if such an area is not found in thecontent, masked watermark complementation module 522 splits thewatermark pieces in the list into smaller pieces (e.g., splits what waseffectively one watermark piece in the list into multiple smallerwatermark pieces), and attempts to render the smaller watermark piecesto effectively render the watermark pieces in the list. Masked watermarkcomplementation module 522 repeats this process for the next list ofneeded watermark pieces (e.g., the next largest list of needed watermarkpieces), until the specified watermark threshold is satisfied or untilthe all the lists of needed watermark pieces have been processed. Maskedwatermark complementation module 522 is further described below withrespect to FIG. 8.

In various embodiments, additional components or a subset of theillustrated components can be employed without deviating from the scopeof the present disclosure. For instance, other embodiments may integratethe various functionalities of the watermark application, including thewatermark mask module and the masked watermark complementation moduleinto fewer modules (e.g., one or two) or more modules (e.g., four orfive, or more). In addition, further note that the various components ofthe watermark application may be distributed across additional machines.In some cases, the watermark mask module and/or the masked watermarkcomplementation module may be downloaded from a server computing systemonto the user device for local execution. In some cases, thefunctionality provided by the watermark mask module and/or the maskedwatermark complementation module may be provided on a server computingsystem communicatively coupled to the user device. In a more generalsense, the degree of integration and distribution of the functionalcomponent(s) provided herein can vary greatly from one embodiment to thenext, as will be appreciated in light of this disclosure.

The embodiments described herein can be implemented in various forms ofhardware, software, firmware, or special purpose processors. Forexample, in one embodiment, a non-transitory computer readable mediumincludes instructions encoded thereon that, when executed by one or moreprocessors, cause aspects of watermark system 504 described herein to beimplemented. The instructions can be encoded using any suitableprogramming language, such as C, C++, object-oriented C, Java,JavaScript, Visual Basic .NET, BASIC, Scala, or alternatively, usingcustom or proprietary instruction sets. Such instructions can beprovided in the form of one or more computer software applications orapplets that are tangibly embodied on a memory device, and that can beexecuted by a computer having any suitable architecture. In oneembodiment, the system can be hosted on a given website and implemented,for example, using JavaScript or another suitable browser-basedtechnology to render, for example, the masked watermarks and/orcomplement watermarks described herein.

The functionalities disclosed herein can optionally be incorporated intoa variety of different software applications and systems, includingwatermarking applications, image sharing applications, photo sharingapplications, web authoring applications, and web authoring systems, toname a few examples. The functionalities disclosed herein canadditionally or alternatively leverage services provided by separatesoftware applications and systems. For example, in one embodiment, thefunctionalities disclosed herein can be implemented in a cloudenvironment, such as Microsoft® Azure®, AWS®, Google Cloud™, or anysuitable cloud environment. Additionally or alternatively, thefunctionalities disclosed herein can be implemented using an IaaSframework as described, for example, in conjunction with FIG. 5A. Thecomputer software applications disclosed herein may include a number ofdifferent modules, sub-modules, or other components of distinctfunctionality, and can provide information to, or receive informationfrom, still other components and services. These modules can be used,for example, to communicate with input/output devices such as a displayscreen, a touch sensitive surface, auditory interface, a digital camera,or any other suitable input/output device. Other components andfunctionality not reflected in the illustrations will be apparent inlight of this disclosure, and it will be appreciated that the presentdisclosure is not intended to be limited to any particular hardware orsoftware configuration. Thus, in other embodiments, the componentsillustrated in FIG. 5 may include additional, fewer, or alternativesubcomponents. Furthermore, in some cases, one or more of the modulesand components illustrated in FIG. 5 may be downloaded from a servercomputing system onto a user device for local execution.

In alternative embodiments, the computers and modules disclosed hereincan be implemented with hardware, including gate level logic such as afield-programmable gate array (FPGA), or alternatively, a purpose-builtsemiconductor such as an application-specific integrated circuit (ASIC).Still other embodiments may be implemented with a microcontroller havinga number of input/output ports for receiving and outputting data, and anumber of embedded routines for carrying out the various functionalitiesdisclosed herein. It will be apparent that any suitable combination ofhardware, software, and firmware can be used in this regard, and thatthe present disclosure is not intended to be limited to any particularsystem architecture.

Referring now to FIG. 5A, a cloud computing environment 550 is depicted,which may also be referred to as a cloud environment, cloud computing orcloud network. The cloud computing environment 550 can provide thedelivery of shared computing services and/or resources to multiple usersor tenants. For example, the shared resources and services can include,but are not limited to, networks, network bandwidth, servers,processing, memory, storage, applications, virtual machines, databases,software, hardware, analytics, and intelligence.

In the cloud computing environment 550, one or more clients 102 a-102 n(such as those described above) are in communication with a cloudnetwork 552. The cloud network 552 may include back-end platforms, e.g.,servers, storage, server farms or data centers. The users or clients 102a-102 n can correspond to a single organization/tenant or multipleorganizations/tenants. More particularly, in one example implementationthe cloud computing environment 550 may provide a private cloud servinga single organization (e.g., enterprise cloud). In another example, thecloud computing environment 550 may provide a community or public cloudserving multiple organizations/tenants.

In some embodiments, a gateway appliance(s) or service may be utilizedto provide access to cloud computing resources and virtual sessions. Byway of example, Citrix Gateway, provided by Citrix Systems, Inc., may bedeployed on-premises or on public clouds to provide users with secureaccess and single sign-on to virtual, SaaS and web applications.Furthermore, to protect users from web threats, a gateway such as CitrixSecure Web Gateway may be used. Citrix Secure Web Gateway uses acloud-based service and a local cache to check for URL reputation andcategory.

In still further embodiments, the cloud computing environment 550 mayprovide a hybrid cloud that is a combination of a public cloud and aprivate cloud. Public clouds may include public servers that aremaintained by third parties to the clients 102 a-102 n or theenterprise/tenant. The servers may be located off-site in remotegeographical locations or otherwise.

The cloud computing environment 550 can provide resource pooling toserve multiple users via clients 102 a-102 n through a multi-tenantenvironment or multi-tenant model with different physical and virtualresources dynamically assigned and reassigned responsive to differentdemands within the respective environment. The multi-tenant environmentcan include a system or architecture that can provide a single instanceof software, an application or a software application to serve multipleusers. In some embodiments, the cloud computing environment 550 canprovide on-demand self-service to unilaterally provision computingcapabilities (e.g., server time, network storage) across a network formultiple clients 102 a-102 n. By way of example, provisioning servicesmay be provided through a system such as Citrix Provisioning Services(Citrix PVS). Citrix PVS is a software-streaming technology thatdelivers patches, updates, and other configuration information tomultiple virtual desktop endpoints through a shared desktop image. Thecloud computing environment 550 can provide an elasticity to dynamicallyscale out or scale in response to different demands from one or moreclients 102. In some embodiments, the cloud computing environment 550can include or provide monitoring services to monitor, control and/orgenerate reports corresponding to the provided shared services andresources.

In some embodiments, the cloud computing environment 550 may providecloud-based delivery of different types of cloud computing services,such as Software as a service (SaaS) 554, Platform as a Service (PaaS)556, Infrastructure as a Service (IaaS) 558, and Desktop as a Service(DaaS) 560, for example. IaaS may refer to a user renting the use ofinfrastructure resources that are needed during a specified time period.IaaS providers may offer storage, networking, servers or virtualizationresources from large pools, allowing the users to quickly scale up byaccessing more resources as needed. Examples of IaaS include AMAZON WEBSERVICES provided by Amazon.com, Inc., of Seattle, Wash., RACKSPACECLOUD provided by Rackspace US, Inc., of San Antonio, Tex., GoogleCompute Engine provided by Google Inc. of Mountain View, Calif., orRIGHTSCALE provided by RightScale, Inc., of Santa Barbara, Calif.

PaaS providers may offer functionality provided by IaaS, including,e.g., storage, networking, servers or virtualization, as well asadditional resources such as, e.g., the operating system, middleware, orruntime resources. Examples of PaaS include WINDOWS AZURE provided byMicrosoft Corporation of Redmond, Wash., Google App Engine provided byGoogle Inc., and HEROKU provided by Heroku, Inc. of San Francisco,Calif.

SaaS providers may offer the resources that PaaS provides, includingstorage, networking, servers, virtualization, operating system,middleware, or runtime resources. In some embodiments, SaaS providersmay offer additional resources including, e.g., data and applicationresources. Examples of SaaS include GOOGLE APPS provided by Google Inc.,SALESFORCE provided by Salesforce.com Inc. of San Francisco, Calif., orOFFICE 365 provided by Microsoft Corporation. Examples of SaaS may alsoinclude data storage providers, e.g. Citrix ShareFile from CitrixSystems, DROPBOX provided by Dropbox, Inc. of San Francisco, Calif.,Microsoft SKYDRIVE provided by Microsoft Corporation, Google Driveprovided by Google Inc., or Apple ICLOUD provided by Apple Inc. ofCupertino, Calif.

Similar to SaaS, DaaS (which is also known as hosted desktop services)is a form of virtual desktop infrastructure (VDI) in which virtualdesktop sessions are typically delivered as a cloud service along withthe apps used on the virtual desktop. Citrix Cloud from Citrix Systemsis one example of a DaaS delivery platform. DaaS delivery platforms maybe hosted on a public cloud computing infrastructure such as AZURE CLOUDfrom Microsoft Corporation of Redmond, Wash. (herein “Azure”), or AMAZONWEB SERVICES provided by Amazon.com, Inc., of Seattle, Wash. (herein“AWS”), for example. In the case of Citrix Cloud, Citrix Workspace appmay be used as a single-entry point for bringing apps, files anddesktops together (whether on-premises or in the cloud) to deliver aunified experience.

FIG. 6 is a flow diagram illustrating an example process 600 forrendering masked visual watermarks, in accordance with an embodiment ofthe present disclosure. The operations, functions, or actionsillustrated in example process 600, and example processes 700 and 800further described below, may in some embodiments be performed by variouscomponents of watermark application 518 of FIG. 5. The operations,functions, or actions described in the respective blocks of exampleprocess 600, and example processes 700 and 800, may also be stored ascomputer-executable instructions in a computer-readable medium, such asmemory 510 and/or data store 516 of watermark system 504 of FIG. 5.

As will be further appreciated in light of this disclosure, for this andother processes and methods disclosed herein, the functions performed inthe processes and methods may be implemented in differing order.Additionally or alternatively, two or more operations may be performedat the same time or otherwise in an overlapping contemporaneous fashion.Furthermore, the outlined actions and operations are only provided asexamples, and some of the actions and operations may be optional,combined into fewer actions and operations, or expanded into additionalactions and operations without detracting from the essence of thedisclosed embodiments.

With reference to FIG. 6, the operations of process 600 can be performedby a watermark application (such as watermark application 518) executingon a processor such as processor 508, for example. At operation 602, thewatermarks that need to be rendered on content (e.g. an image) areidentified. For example, data regarding the watermark such as thewatermark itself, size of the watermark, and orientation of thewatermark, to provide a few examples, number of instances of thewatermark to render, and locations in the content at which to render theinstances of the watermark may be provided in a watermark definitionfile. At operation 604, the identified watermarks are rendered on thecontent by masking the watermarks as necessary. In an exampleimplementation, watermark mask module 520 may be utilized to render thewatermarks on the content. At operation 606, a check is made todetermine whether the instances of the rendered watermarks, includingthe rendered masked watermarks, satisfy a specified watermark threshold(i.e., are at least a threshold number of complete watermarks beinggenerated and/or rendered). If the watermark threshold is satisfied,then, at operation 608, a conclusion is made that the instances of therendered watermarks are sufficient. Otherwise, if the watermarkthreshold is not satisfied, then, at operation 610, the rendered maskedwatermarks are complemented in an attempt to satisfy the watermarkthreshold. In an example implementation, masked watermarkcomplementation module 522 may be utilized to complement the maskedwatermarks.

FIG. 7 is a flow diagram illustrating an example process 700 forrendering a watermark by masking the watermark as necessary, inaccordance with an embodiment of the present disclosure. The operationsof process 700 can be performed by masked watermark complementationmodule 522. At operation 702, the content and the applied watermarks inthe content are read. For example, in an illustrative embodiment,reading content (e.g., an image) allows for detecting data elements andthe locations of the data elements in the content, and reading thewatermarks allows for determining the size or sizes of the watermarksand the locations of the watermarks in the content. At operation 704, acheck is made to determine whether all the watermarks have beenprocessed for rendering. If all the watermarks have been processed,then, at operation 706, the processing of the watermarks is complete.Otherwise, if all the watermarks have not all been processed, then, atoperation 708, a watermark to process for rendering is identified. Theidentified watermark can be referred to as a current watermark (acurrent watermark being processed). At operation 710, the currentwatermark is segmented into multiple watermark pieces.

At operation 712, a check is made to determine whether all the watermarkpieces of the current watermark have been processed. If all thewatermark pieces of the current watermark have been processed, then, atoperation 704, a check is made to determine whether all the watermarkshave been processed for rendering, and the processing continues.Otherwise, if all the watermark pieces of the current watermark have notbeen processed, then, at operation 714, a watermark piece to process isidentified. The identified watermark piece is a piece of the currentwatermark, and can be referred to as a current watermark piece (acurrent watermark being processed).

At operation 716, a check is made to determine whether a data element ispresent at the location in the content (e.g., a location in an image) atwhich the current watermark piece is to be rendered. If a data elementis detected at the location at which the current watermark piece is tobe rendered, then, at operation 718, the current watermark piece isrendered at that location such that the data element overlays thecurrent watermark piece. Otherwise, if a data element is not detected atthe location at which the current watermark piece is to be rendered,then, at operation 720, the current watermark piece is rendered at thatlocation such that the current watermark piece overlays the content(e.g., the current watermark piece overlays the data element or aportion of the data element). In any cases, subsequent to processing thecurrent watermark piece, at operation 712, a check is made to determinewhether all the watermark pieces of the current watermark have beenprocessed, and the processing continues.

FIG. 8 is a flow diagram illustrating an example process 800 forcomplementing a masked watermark, in accordance with an embodiment ofthe present disclosure. The operations of process 800 can be performedby masked watermark complementation module 522. At operation 802, acheck is made to determine whether the specified watermark threshold issatisfied. In particular, a check is being made to determine whethersufficient complement watermarks have been rendered on the content, whencombined with the rendered masked watermarks and the other renderedcomplete watermarks, to satisfy the specified watermark threshold. Ifthe watermark threshold is satisfied, then the rendered complementwatermarks are sufficient and, at operation 804, the processingcompletes. Otherwise, if the watermark threshold is not satisfied, then,at operation 806, the watermark pieces that are needed (e.g., the piecesof the rendered masked watermarks which were not rendered due to thepresence of data elements) are organized into one or more organizedlists. Here, each list includes the watermark piece or pieces needed tocomplement (i.e., complete) a particular rendered masked watermark.Thus, for example, in the case of two rendered masked watermarks, therewould be two organized lists of needed watermarks.

At operation 808, the size of the content area (e.g., image area) neededto render the watermark pieces in the longest list is computed. In thisexample case, the lists of watermark pieces are being processed in anorder beginning with the longest list. That is, an attempt is being madeto render the watermark pieces in the longest list first. Note, however,that the lists of watermark pieces can be processed in any order. Forexample, in other embodiments, the lists of watermark pieces can beprocessed starting with the shortest list or in an arbitrary order. Thelongest list remaining to be processed can be referred to as a currentlist (a current list of watermark pieces being processed).

At operation 810, a check is made to determine whether there issufficient blank area in the content in which to render the watermarkpieces in the current list. In one embodiment, the same or similartechniques used to detect data elements in the content can be used todetermine whether there is sufficient blank area in the content torender the watermark pieces in the current list. If such a blank area inthe content is found, then, at operation 812, the watermark pieces inthe current list are rendered on the identified blank area of thecontent as a complement watermark. Then, at operation 802, a check ismade to determine whether the specified watermark threshold issatisfied, and the processing continues. Here, a check is being made todetermine whether the just rendered complement watermark was sufficient,when combined with the rendered masked watermarks and the other renderedcomplete watermarks, to satisfy the specified watermark threshold.

Otherwise, if sufficient blank area in the content to render thewatermark pieces in the current list is not found, then, at operation814, a check is made to determine whether the current list can be splitinto multiple smaller lists. Here, since the needed blank area to renderthe watermark pieces in current list together (e.g., as a single piece)was not found (operation 810), an attempt is going to be made to renderthese watermark pieces in smaller chunks in distinct areas in thecontent instead of together in one area of the content. Note that theremay be a limit as to how short (small) a list can be and/or the numberof times a list can be split. For example, this limit may be specifiedin a configuration file that is accessible to an authorized user (suchas a system administrator), and the user may tune or adjust the limitbased on a desired level of performance.

If the current list can be split, then, at operation 816, the currentlist is split into multiple smaller lists. Note that the individualwatermark pieces in the current list need not be maintained (preserved)when splitting the current list. That is, the current list can be splitinto multiple smaller lists without regard to the characteristics of theindividual watermark pieces in the current list. Then, at operation 808,the size of the area needed to render the watermark pieces in thelongest list is computed, and the processing continues. In this case,the longest list is the longest of the multiple smaller lists created bysplitting the current list (operation 816).

Otherwise, if the current list cannot be split further (e.g., thecurrent list has been split a pre-established number of times or thelength of the current list is such that splitting the current list willcreate a smaller list that is shorter than a pre-established limit onthe length), then, at operation 818, the next longest list of watermarkpieces is identified, if possible, and the processing continues. Here,since the current list cannot be rendered on the content, even insmaller chunks (operation 814), an attempt is going to be made to renderthe watermark pieces in the next list (e.g., next longest list) tosatisfy the watermark threshold. However, it may be the case that allthe lists of needed watermark pieces have been processed and there willnot be any further list to process. The result in this case is that thespecified watermark threshold cannot be satisfied, and an errornotification may be generated to inform of this result.

In the description of the various embodiments, reference is made to theaccompanying drawings identified above and which form a part hereof, andin which is shown by way of illustration various embodiments in whichaspects of the concepts described herein may be practiced. It is to beunderstood that other embodiments may be utilized, and structural andfunctional modifications may be made without departing from the scope ofthe concepts described herein. It should thus be understood that variousaspects of the concepts described herein may be implemented inembodiments other than those specifically described herein. It shouldalso be appreciated that the concepts described herein are capable ofbeing practiced or being carried out in ways which are different thanthose specifically described herein.

As used in the present disclosure, the terms “engine” or “module” or“component” may refer to specific hardware implementations configured toperform the actions of the engine or module or component and/or softwareobjects or software routines that may be stored on and/or executed bygeneral purpose hardware (e.g., computer-readable media, processingdevices, etc.) of the computing system. In some embodiments, thedifferent components, modules, engines, and services described in thepresent disclosure may be implemented as objects or processes thatexecute on the computing system (e.g., as separate threads). While someof the system and methods described in the present disclosure aregenerally described as being implemented in software (stored on and/orexecuted by general purpose hardware), specific hardwareimplementations, firmware implements, or any combination thereof arealso possible and contemplated. In this description, a “computingentity” may be any computing system as previously described in thepresent disclosure, or any module or combination of modulates executingon a computing system.

Terms used in the present disclosure and in the appended claims (e.g.,bodies of the appended claims) are generally intended as “open” terms(e.g., the term “including” should be interpreted as “including, but notlimited to,” the term “having” should be interpreted as “having atleast,” the term “includes” should be interpreted as “includes, but isnot limited to,” etc.).

Additionally, if a specific number of an introduced claim recitation isintended, such an intent will be explicitly recited in the claim, and inthe absence of such recitation no such intent is present. For example,as an aid to understanding, the following appended claims may containusage of the introductory phrases “at least one” and “one or more” tointroduce claim recitations. However, the use of such phrases should notbe construed to imply that the introduction of a claim recitation by theindefinite articles “a” or “an” limits any particular claim containingsuch introduced claim recitation to embodiments containing only one suchrecitation, even when the same claim includes the introductory phrases“one or more” or “at least one” and indefinite articles such as “a” or“an” (e.g., “a” and/or “an” should be interpreted to mean “at least one”or “one or more”); the same holds true for the use of definite articlesused to introduce claim recitations.

In addition, even if a specific number of an introduced claim recitationis explicitly recited, such recitation should be interpreted to mean atleast the recited number (e.g., the bare recitation of “two widgets,”without other modifiers, means at least two widgets, or two or morewidgets). Furthermore, in those instances where a convention analogousto “at least one of A, B, and C, etc.” or “one or more of A, B, and C,etc.” is used, in general such a construction is intended to include Aalone, B alone, C alone, A and B together, A and C together, B and Ctogether, or A, B, and C together, etc.

It is to be understood that the phraseology and terminology used hereinare for the purpose of description and should not be regarded aslimiting. Rather, the phrases and terms used herein are to be giventheir broadest interpretation and meaning. The use of “including” and“comprising” and variations thereof is meant to encompass the itemslisted thereafter and equivalents thereof as well as additional itemsand equivalents thereof. The use of the terms “connected,” “coupled,”and similar terms, is meant to include both direct and indirect,connecting, and coupling.

All examples and conditional language recited in the present disclosureare intended for pedagogical examples to aid the reader in understandingthe present disclosure, and are to be construed as being withoutlimitation to such specifically recited examples and conditions.Although example embodiments of the present disclosure have beendescribed in detail, various changes, substitutions, and alterationscould be made hereto without departing from the spirit and scope of thepresent disclosure. Accordingly, it is intended that the scope of thepresent disclosure be limited not by this detailed description, butrather by the claims appended hereto.

1. A method comprising: detecting data elements in content; rendering afirst instance of a watermark on the content such that at least aportion of the watermark within the first instance is overlaid by one ormore of the data elements; and rendering a second instance of thewatermark on the content such that the second instance is visible, thefirst and second instances of the watermark collectively conveying acomplete watermark.
 2. The method of claim 1, wherein overlaying the oneor more of the data elements onto the at least a portion of thewatermark is responsive to the one or more data elements being presentat a location within the content at which to apply the at least aportion of the watermark.
 3. The method of claim 1, wherein therendering of the second instance of the watermark is responsive todetermination that a threshold is not satisfied.
 4. The method of claim3, wherein the threshold corresponds to a minimum number of completewatermarks to be visible on the content.
 5. The method of claim 1further comprising: segmenting the watermark into a plurality ofwatermark pieces, wherein the rendering of the first instance of thewatermark on the content includes rendering at least one of theplurality of watermark pieces on the content such that the plurality ofwatermark pieces do not obfuscate the one or more of the data elements.6. The method of claim 5, wherein the rendering of the second instanceof the watermark on the content includes rendering the at least one ofthe plurality of watermark pieces as not to be overlaid by the dataelements.
 7. The method of claim 1, wherein the rendering of the secondinstance of the watermark on the content includes rendering the secondinstance of the watermark in a blank area in the content.
 8. The methodof claim 1, wherein the data elements include text elements.
 9. Themethod of claim 1, wherein the data elements include control elements ofa user interface (UI).
 10. A method comprising: rendering a firstinstance of a watermark on content based on detection of a data elementat a location within the content at which to apply the watermark, therendering being such that the data element remains visible afterrendering of the first instance; and rendering a second instance of thewatermark on the content such that the second instance is visible andincludes a portion of the first instance, the first and second instancesof the watermark collectively conveying a complete watermark.
 11. Themethod of claim 10, wherein the rendering of the first instance of thewatermark on the content is such that the at least a portion of thewatermark within the first instance is not visible is.
 12. The method ofclaim 10, wherein the rendering of the second instance of the watermarkis responsive to determination that a threshold is not satisfied. 13.The method of claim 12, wherein the threshold corresponds to a minimumnumber of complete watermarks to be visible on the content.
 14. Themethod of claim 10, the process including: segmenting the watermark intoa plurality of watermark pieces, wherein the rendering of the firstinstance of the watermark on the content includes rendering at least oneof the plurality of watermark pieces on the content such that the dataelement remains visible after rendering of the at least one of theplurality of watermark pieces.
 15. The method of claim 14, wherein therendering of the second instance of the watermark on the contentincludes rendering the at least one of the plurality of watermark piecesas not to be overlaid by the data element.
 16. The method of claim 10,wherein the rendering of the second instance of the watermark on thecontent includes rendering the second instance of the watermark in ablank area in the content.
 17. The method of claim 10, wherein the dataelement is control element of a user interface (UI).
 18. A systemcomprising: a memory; and one or more processors in communication withthe memory and configured to: detect data elements in content; render afirst instance of a watermark on the content such that at least aportion of the watermark within the first instance is overlaid by one ormore of the data elements; and render a second instance of the watermarkon the content such the second instance is visible, the first and secondinstances of the watermark collectively conveying a complete watermark.19. The system of claim 18, wherein overlaying the one or more of thedata elements onto the at least a portion of the watermark is responsiveto the one or more data elements being present at a location within thecontent at which to apply the at least a portion of the watermark. 20.The system of claim 18, wherein the one or more processors are furtherconfigured to: segment the watermark into a plurality of watermarkpieces, wherein the rendering of the first instance of the watermark onthe content includes rendering at least one of the plurality ofwatermark pieces on the content such that the plurality of watermarkpieces do not obfuscate the one or more of the data elements.